GhostStep Privacy Policy

Effective date: October 14, 2026 · Contact: support@ghoststep.app

Summary

GhostStep is a rhythm-game score tracker and practice companion. It has no ads, no third-party analytics, no tracking, and never sells data. The only data it stores off-device is what makes score sync and player profiles work, and you can delete all of it from inside the app at any time.

What the app stores

• A random device token. Generated on first use. It is not derived from you or your device and is the only key your synced data is stored under.
• Your scores. If you use score sync, your play scores (song, difficulty, score, clear type, play time) are uploaded to our server keyed by that token so they can be restored and shown in your profile.
• Profile names. Your in-game dancer name (shown to other users on your public profile) and, privately, your rival code and network nickname. The private fields are never shown to anyone and exist only so your profile stays yours if you rename. You can make your whole profile private to other users in the app.
• Arcade locations. When you sync, the app reads the arcades where your scores were played from your game network's own play-history pages, the same information that site already shows you. They are saved with your profile, and your favorite arcade is shown to your friends unless you turn that off in Settings. The app never uses your device's location services.
• Push notification token. If you allow notifications, your phone's push token is stored so we can send the notifications you asked for (for example friend requests).
• Diagnostics. Crash reports and sync diagnostics (which sync step ran, how long each page took, error messages) are sent with your device token so we can fix problems. They contain no passwords or contact details and are deleted after 14 days.
• Bug reports you send. If you send feedback or a bug report from the app, we keep your message and any optional contact handle you add.

What the app never collects

• Your login credentials. When you link your game-network account, you sign in on the network's own website inside a secure in-app browser. Your password is never sent to our server. If you turn on the optional "Save login" feature, your login is saved only in your phone's secure storage (Keychain) so the app can fill it in for you; it never leaves your phone.
• Microphone audio. If a build includes listening features, microphone audio is processed entirely on the device, in memory, and is never recorded, stored, or transmitted.
• No device location, no contacts, no advertising identifiers, no analytics or tracking.

Public player profiles

Profile statistics shown in the app (including those of other players) are derived from publicly visible leaderboard data. If a profile is yours you can claim it via score sync and set it private, which hides its statistics from other users.

Deleting your data

In the app: Settings → Delete my cloud data. This permanently removes your synced scores, profile, and private identity fields from our server. You can also email us at the address above and we will delete it for you.

Retention and sharing

Data is kept until you delete it, except diagnostics, which are deleted after 14 days. It is never sold, rented, or shared with third parties. It is hosted on Cloudflare infrastructure.

Children

The app is not directed at children under 13 and does not knowingly collect personal information from them.

Changes

If this policy changes, the new version will be posted at this URL with an updated effective date.